diff --git a/.env.example b/.env.example
index cfa172eb68..e97f65d4c1 100644
--- a/.env.example
+++ b/.env.example
@@ -12,4 +12,14 @@
 # PASCAL_ADMIN_PASSWORD=change-me
 
 # Optional bearer token for agents and scripts calling /api/scenes.
+# Behind a reverse proxy, the proxy can inject this as an Authorization or
+# X-Pascal-Scene-Token header.
 # PASCAL_SCENE_API_TOKEN=change-me-too
+
+# If using an upstream proxy (e.g. Cloudflare Access, Authelia, basic auth),
+# set PASCAL_AUTH=proxy to allow the proxy to handle authentication.
+# Ignored when PASCAL_ADMIN_PASSWORD is set.
+# PASCAL_AUTH=proxy
+
+# Allowed origins for CORS scene API requests (comma-separated).
+# PASCAL_SCENE_API_ORIGINS=https://pascal.example.com
diff --git a/SETUP.md b/SETUP.md
index cd6ec05469..d5f40112dd 100644
--- a/SETUP.md
+++ b/SETUP.md
@@ -31,8 +31,9 @@ cp .env.example .env
 | `PORT` | No | Dev server port (default: 3002) |
 | `PASCAL_PUBLIC_URL` | No | The address people use to reach the editor. Read per request; set it when Pascal is hosted outside localhost (Mint sign-in and agent links use it). |
 | `PASCAL_ADMIN_PASSWORD` | On a network host | The one password that unlocks a self-hosted editor. See "Self-hosting". |
-| `PASCAL_AUTH` | No | `proxy` lets a reverse proxy that already authenticates every request replace the password. |
-| `PASCAL_SCENE_API_TOKEN` | No | Bearer token for agents and scripts calling `/api/scenes`. |
+| `PASCAL_AUTH` | No | `proxy` lets a reverse proxy that already authenticates every request replace the password. Ignored when `PASCAL_ADMIN_PASSWORD` is set. |
+| `PASCAL_SCENE_API_TOKEN` | No | Bearer token for agents, scripts, or reverse-proxy deployments calling `/api/scenes`. |
+| `PASCAL_SCENE_API_ORIGINS` | No | Comma-separated allowed origins for cross-origin scene API requests. |
 | `PASCAL_DATA_DIR` | No | Directory holding `pascal.db` and artifacts (default: `~/.pascal/data`). |
 
 Local development and the official hosted editor work without any environment variables.
@@ -61,7 +62,12 @@ How it is protected, by `apps/editor/lib/self-host-auth.ts`:
   endpoint under "Connect an agent".
 - **Fail closed.** A host that is not loopback with no password set serves a setup page
   listing the variables and nothing else. `PASCAL_AUTH=proxy` opts out when a reverse proxy
-  (basic auth, SSO) already authenticates every request.
+  (basic auth, SSO) already authenticates every request; in that mode `/api/scenes` accepts
+  every request that reaches Pascal, so make sure the app is only reachable through the proxy.
+  `PASCAL_AUTH=proxy` is ignored when `PASCAL_ADMIN_PASSWORD` is set.
+  If you protect the scene API with `PASCAL_SCENE_API_TOKEN` behind a proxy, configure your
+  reverse proxy to inject `Authorization: Bearer <token>` or `X-Pascal-Scene-Token: <token>`
+  on forwarded requests to `/api/scenes`.
 - **Loopback stays open.** `bun dev`, the CLI's managed editor and `docker run` reached at
   `localhost` need no password. Opening a dev server to another device on your LAN counts
   as a network host: set `PASCAL_ADMIN_PASSWORD` in `.env.local` for that.